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AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1 . (Currently amended) A method for managing traffic in a commimications network 
comprising acts of: 

(a) providing, in a network device, a cache containing at least predefined 
characteristics associated with packets and actions paired with selected ones of said 
predefined characteristics; 

(b) receiving at least one of the packets in said network device; 

(c) selecting, fiom said received packet, characteristics similar to the at least 
predefined characteristics; 

(d) correlating the characteristics selected firom said received packet with the 
predefined characteristics; smd 

(e) using results from the correlating step to perform Layer 3 or higher 
classification of the received packet; 

(f) identifying data packets with most bundling when compared to other data 
packets: and 

(g) initializing an expiration timer that controls a frequency at which the cache is 
aged, wherein the expiration timer corresponds to an expected biorst interval of the 
identified packets . 

2. (Original) The method of claim 1 wherein the process includes enforcing the 
paired action against the received packet if the characteristics of said received packet 
matches the at least predefined characteristics. 
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3. (Original) The method of claim 1 or claim 2 wherein the at least predefined 
characteristics include Internet Protocol (IP) Destination Address (DA), IP Soiorce 
Address (SA), Transmission Control Protocol (TCP) Destination Port (DP) and TCP 
Source Port (SP). 

4. (Original) The method of claim 1 wherein the correlating act includes comparing, 

5. (Currently amended) A method comprising acts of: 

providing in a memory a mapping of predefined characteristics associated with 
packets and actions to be performed; 

receiving packets to be classified; 

correlating selected characteristics of received packets with the predefined 
characteristics; aad 

performing stored actions on said received packets, if the selected characteristics 

match the predefined characteristics, wherein the performed stored actions include Layer 

3 or higher fi-ame classification actions; 

identifying packets with most bimdling when compared to other data packets; and 
initializing an expiration timer that controls a fi-equency at which contents of the 

memory are altered, wherein the expiration timer corresponds to an expected burst 

interval of the identified packets . 

6. (Original) The method of claim 5 wherein the correlating act includes comparing. 

7. (Original) The method of claim 5 wherein the predefined characteristics include 
Source Address (SA), Destination Address (DA), Source Port (SP) and Destination Port 
(DP). 
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8. (Original) The method of claim 5 wherein the received packets include data 
packets. 

9. (Previously presented) The method of claim 5 wherein the stored actions 
associated with predefined characteristics are updated only from a first packet of a group 
of packets. 

10. (Original) The method of claim 9 wherein the stored actions are being performed 
on all packets following the first packet of the group of packets. 

1 1 . (Currently amended) A system including 
a processor; 

a cache operatively coupled to said processor, said cache storing a mapping 
between predefined characteristics of packets and actions wherein said processor 
executes a first program that causes said processor to correlate characteristics of selected 
packets with the predefined characteristics and enforcing on said selected packets actions 
associated with predefined characteristics if characteristics fix)m the selected packets 
match the predefined characteristics; and 

a memory operatively coupled to said processor and storing therein: 

a first data structure for a full packet search wherein said processor 
executes a second program that causes said processor to access the first data 
structure and imposing on said selected packet an action stored in said first data 
structure if a mismatch occurs between the predefined characteristics and the 
characteristics from the selected packets; and 

a second data structure that includes an aging algorithm for aging the 
cache, the aging algorithm initializes an expiration timer, decrements the 
expiration timer by a check time interval that is less than a current value of the 
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expiration timer, reviews a Layer 3 or Layer 4 database for a change to the Layer 
3 or Layer 4 database, and purges the cache if a change has been made during the 
check time interval , wherein the expiration timer corresponds to an expected burst 
interval of data packets identified as frequent flyer packets . 

12. (Original) The system of claim 1 1 wherein the predefined characteristics include 
Source Address (SA), Destination Address (DA), Source Port (SP) and Destination Port 
(DP). 

13. (Original) The system of claim 1 1 wherein the processor includes a network 
processor. 

14. (Cancelled). 

15. (Previously presented) The system of claim 1 1 wherein the selected packet 
includes received packets. 

16. (Previously presented) The system of claim 1 1 wherein the second program 
includes a full match algorithm. 

17. (Previously presented) The system of claim 1 1 wherein the second program 
includes a Longest Prefix Match algorithm. 

1 8. (Previously presented) The system of claim 1 1 wherein the second program 
includes a Software Managed Tree algorithm. 
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19. (Previously presented) The system of claim 1 1 wherein the memory is internal to 
the processor. 

20. (Previously presented) The system of claim 1 1 wherein the memory is external to 
the processor. 

21 . (Previously presented) The system of claim 1 1 wherein the data structure includes 
a Direct Table and Patricia Tree. 

22. (Currently amended) A system including 

a memory that stores a mapping between predefined characteristics of packets and 
actions to be performed for a subset of the set of all characteristic values, wherein the 
actions to be performed are Layer 3 or higher classification actions; and 

a controller that performs the following actions: 

correlates characteristics in a received packet with the predefined 

characteristics and performing the actions on said received packet if the 

characteristics match the predefined characteristic s: and 

uses an expiration timer to age the memory, wherein the expiration timer 

corresponds to an expected burst interval of packets identified as being frequent 

flyer packets . 
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23. (Currently amended) A computer-readable medium comprising computer- 
executable instructions that, when executed by a processor, produce a method that 
comprises: 

correlating characteristics of a received packet with characteristics in a table, said 
table containing a subset of all possible characteristic values; md 

enforcing an action stored in said table on the received packet if the 
characteristics of the received packet and the characteristics in the table match, wherein 
the action facilitates Layer 3 or higher packet classificatio n: and 

updating contents of the table at times that correspond to an expected biirst 
interval of data packets that are identified as being frequency flyer data packets . 

24. (Previously presented) The computer-readable medium of claim 23 fiirther 
including instructions to generate the table containing the characteristics and associated 
actions. 

25-30. (Cancelled) 

3 1 . (Currently amended) A method of classifying packets in a communications 
network comprising acts of: 

(a) receiving packets in a network device; 

(b) determining data packets present in received packets and identifying which 
packets are frequency flyer packets : 

(c) providing a cache in which predefined characteristics of packets and actions 
associated with selected ones of the predefined characteristics are stored; 

for each data packet so determined, correlating selected characteristics of said 
each data packet with the predefined characteristics in said cache; mi 
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for each data packet with selected characteristics matching one of the predefined 
characteristics imposing on said each data packet the action associated with said one of 
the predefined characteristics, wherein the packets include TCP/IP packets, and wherein 
the determining act fiirther includes the acts of: 

examining control bits in the TCP header; 

if selected ones of said control bits are set to a first state, examining a 

length field in the IP header to determine its value; 

multiplying a value in the data offset field in the TCP header by 4; and 
subtracting the result of the multiplication fi-om the value in the length 

fiel d: and 

(d) updating contents of the cache at times that correspond to an expected burst 
interval of packets identified as fi-equency flyer packets . 

32-33. (Cancelled) 

34. (Previously presented) The method of claim 3 1 wherein the first state includes 
logical "0". 

35. (Previously presented) The method of claim 3 1 wherein the selected ones of said 
control bits include SYN, FIN and RST. 
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